I have below 3 different set of events coming from same source. So i have extracted the field using rex command for each type of event. This is working fine when i use each 'rex' command separately. But when i combine all 3 rex commands, it's giving me 0 results. Is there any way to fix this ? host01u,UAT,2300970,app.rmkb.hk-122,,Deployment Success host01u,UAT,2319971,app.bww.label-34,HOLD,Deployment Success host02u,UAT,2319237,app.static-540,No_File My Query: index=foo source=status.list | rex field=_raw "(?<Server>\w+.*)\,(?<Environment>\w+.*)\,(?<Req>\d+.*)\,(?<Package>\w+.*)\,(?<Command>)\,(?<Deploy_Status>\w+.*)" | rex field=_raw "(?<Server>\w+.*)\,(?<Environment>\w+.*)\,(?<Req>\d+.*)\,(?<Package>\w+.*)\,(?<Command>\w+.*)\,(?<Deploy_Status>\w+.*)" | rex field=_raw "(?<Server>\w+.*)\,(?<Environment>\w+.*)\,(?<Req>\d+.*)\,(?<Package>\w+.*)\,(?<Deploy_Status>\w+.*)" | stats latest(*) as * by Server,Environment,Package | table Server,Environment,Req,Package,Deploy_Status | dedup Server,Environment,Req,Package,Deploy_Status | stats count by Deploy_Status
... View more